Network communications and other computer input/output (I/O) operations are often implemented using multiple protocols. Low-level protocols typically interact with device hardware or transport media, and high-level protocols typically interact with software applications. A series of protocol processing components from lower-level protocols to higher-level protocols, is referred to as a protocol stack, and each component within the stack is referred to as a protocol layer. A data object such as an I/O packet is typically passed serially through the layers of a protocol stack as it is transferred between an application and a physical transport mechanism.
As an example, a network communications protocol stack may include the following protocols and corresponding layers:
ProtocolLayerHTTPApplicationTCPTransportIPInternetEthernetLinkIEEE 802.3uPhysical
For purposes of debugging and troubleshooting, it is often useful to trace the progress of a single data packet through the protocol stack. Some operating systems allow the protocol layers to report or log events related to packet processing, and some operating systems may support repositories, APIs (application programming interfaces), reporting tools, and other central functionality to facilitate event reporting and logging.
Generally, each layer of the protocol stack is isolated from other layers of the stack. However, data packets passed between the layers may include so-called “out-of-band” data, in addition to the actual I/O data. In order to trace a particular data packet through the protocol stack, an identifier may be associated with the data packet, and passed from layer to layer in the out-of-band data associated with the data packet. When logging an event, each layer reports the packet identifier to the logging system along with other information about the event. This allows reporting services to gather all logged events relating to a single packet, and to reconstruct a trace that shows how the packet is handled as it traverses the protocol stack. This method can be used with activities of various types, so that all events occurring within a protocol stack that are related to a single activity can be easily identified.
The increasing use of virtualization in computing environments has introduced challenges relating to diagnostics and troubleshooting. In a virtual computing environment, a single physical machine may host a number of virtual machines. Each machine, including the host machine and the virtual machines, may have its own operating system and implement its own protocol stacks. Furthermore, each of the protocol stacks may operate independently of other protocol stacks, and there is no convenient way to correlate the events reported from one protocol stack to those reported from another protocol stack.